Malicious PDF — malware analysis report

Static analysis result for SHA-256 07c7789f1d403a7d…

MALICIOUS

PDF

37.3 KB Authoring application: Soda PDF
MD5: dbbbf207fb4ddca2db676c9c2176fff8 SHA-1: 4f6f975203150bc2fb7971622aa0e8fe3ed396a3 SHA-256: 07c7789f1d403a7d54f9268d7b869fb6604cafdc94abc432d7f28c36365f7afb
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs, forming a link farm, which is a common tactic for phishing or distributing malware. The document body itself attempts to trick the user into downloading a PDF by offering a guide for installing game cheats. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution via the linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://piercingsbylexie.com/uploads/1/3/0/5/130550763/4c806551343.pdf
    • http://cutcliffes.com/uploads/1/3/0/5/130551576/losotaloleg.pdf
    • http://arthvrian.net/uploads/1/3/0/5/130543941/lodemi_wumop_mepop.pdf
    • http://starvedrockarea.com/uploads/1/3/0/6/130621450/zekebetakupe.pdf
    • http://topshamfinearts.com/uploads/1/3/0/3/130379295/6b6a875b5c.pdf
    • http://jonathanecollins.com/uploads/1/3/0/6/130605270/934e1958c.pdf
    • http://milton-trails.com/uploads/1/3/0/5/130551132/runuwovi.pdf
    • http://nau-systems.com/uploads/1/3/0/6/130621521/pizifarikufeso-rajalu-towud.pdf
    • http://dadevilleband.com/uploads/1/3/0/5/130543093/rifetupu.pdf
    • http://rix.sar-svet.ru/uploads/2020/01/29/5983028.pdf
    • http://worldwildlifeweb.net/uploads/1/3/0/5/130544725/powevudupi_veduranogigit_lomew.pdf
    • http://hulkimatum.net/uploads/1/3/0/3/130324004/sulasojo_vububiworemavib.pdf
    • http://kylaconner.com/uploads/1/3/0/5/130590384/130590384.html#how+to+download+and+install+cheat+menu+in+gta+san+andreas

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001344.bin
bfa5f76d4fdd3316962717d4c62b85b8f1a5f0d22d9c9a0839f8a22a467e61cb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1344 8140 bytes
font_01_sfnt_off000055bb.bin
f89c0e0946aa0d1e48aa5356a2d31bc24f5b96ca1f2cb84330b25817f6444d93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55BB 2024 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.